qa(checklist): identity-auth — 23 ledger edits from the 18.2.0 release sweep (#25807) #25843

Filing gate: maintainer-directed task. Filed by the 18.2.0 release-assessment thread · session_01G3h9iZTpL8aCiXbfsp8H5u. ⛔ Not a claim, ⛔ not dispatched.

Maintainer's words (project thread, 2026-10-25, verbatim): 22:54Z 「约 300 条清单准确性问题：是不是应该开卡？」, then 22:55Z 「写issue，不派发」.

Parent: wave anchor #25807 (18.2.0 release test sweep). RUNNER's extraction obligation parks checklist-accuracy findings on the anchor; the maintainer asked for them as issues, so the wave's findings are split into one card per ledger file and the anchor links each card. This is not a release blocker, so it carries no target:v18.

Reader who acts: the lane owning docs/qa/platform-checklist/** (domain:devx). Dedupe (open and closed): no card holds these lines; the 18.0 precedent closed its accuracy rows on its anchor #24579.

Wanted

For each line below, edit docs/qa/platform-checklist/areas/identity-auth.json: revise the item's text, bump its revision, and append a history entry citing the run record the line comes from. Keep pnpm check:platform-checklist green. A line that turns out to describe a product defect rather than stale text gets its own card instead of a ledger edit.

Findings (23)

From #25812 — priority:P0, 23 items, at 6679644a, pin b41ed7f68956

• identity-auth.default-organization-boot-invariant: step 3 filters organization = default, the column is organization_id and takes the org id; fixtures.requires says --fresh but c1 needs --log-level info and a readable file DB; acc[0] prescribes --maxWorkers=2 against RUNNER's memory fact.

From #25815 — release-18.2.0-tier1, 156 items, at 6679644a, pin b41ed7f68956 (clause labels: aK = acceptance[K], nK = negative[K])

• identity-auth.admin-lifecycle-operations a4: verify says the 'target's next PROTECTED request still 2xx' is pinned by admin-platform-admin-standing.dogfood.test.ts; that file asserts the 403 + code only, no protected request as the target
• identity-auth.admin-lifecycle-operations a0/n1: C0 case asserts sys_user.banned/ban_reason and unban; no sign-in by the banned user is attempted, so the enforcement half is unpinned
• identity-auth.admin-lifecycle-operations ref-parse: packages/plugins/plugin-auth/src/remove-user-atomicity.test.ts is named in the ref only as a contrast ('deliberately does NOT copy'), not as a pin; the parent's pins list includes it — it scores no clause
• identity-auth.api-key-expiry-lifecycle a2: the dogfood case asserts 400 API_KEY_EXPIRY_TOO_LONG but not that the key count is unchanged; 'nothing is stored' is asserted only in packages/runtime/src/api-key-lifecycle.pin.test.ts over a fake objectql
• identity-auth.api-key-expiry-lifecycle a3: the three 403 codes are pinned only at unit layer (rest-api-key-lifecycle.pin.test.ts over HTTP_STUB + fake ql; runtime dispatcher over a fake kernel); the dogfood file drives no revoked or expired key
• identity-auth.auth-gate-held-session-raw-host-families a2: held-session-vendor-admin-doors arms PASSWORD_RESET_REQUIRED by a system write of must_change_password + auth.noteMustChangePasswordIssued() (simulating the forced-reset route), not by driving the admin's forced-reset door
• identity-auth.auth-gate-held-session-raw-host-families a3: rest-api-key-account-posture.pin drives RestServer.enforceAuth with a hand-built req/res and a fake auth; http-dispatcher.api-key-account-posture drives HttpDispatcher with fakes — neither answers an HTTP x-api-key call
• identity-auth.auth-gate-held-session-raw-host-families a1: 'raw-host families' are proven at mixed layers: storage, settings, share-link and cloud-connection pins call registered handlers with fake IHttpRequest/IHttpResponse
• identity-auth.auth-method-matrix a3: verify names packages/plugins/plugin-auth/src/phone-otp-no-sms-service-refusal.test.ts as the pin — it exists but is not in automated.ref, and it drives AuthManager (unit), not the NODE_ENV=production boot's send-otp door.
• identity-auth.auth-method-matrix a6: verify names packages/qa/dogfood/test/two-factor-lockout.dogfood.test.ts as the end-to-end pin for the 2FA gate — exists, not in automated.ref.
• identity-auth.auth-method-matrix a9: verify names packages/plugins/plugin-auth/src/change-email-delete-user-wiring.test.ts ('auth-method-matrix: change-email and delete-user are booked as mounted in auth-route-ledger.ts but plugin-auth never configures better-auth's user.changeEmail / user.deleteUser — no switch to enable them #7735 — POST /delete-user stays unwired') — exists, not in automated.ref; AuthManager unit layer.
• identity-auth.auth-method-matrix ref: a single OIDC pin (a7) for a 10-clause, 5-negative mixed item; kind 'e2e' over-implies coverage.
• identity-auth.cookie-session-renewal-in-process a1: the runtime pin's DOORS are GET /data/:object, /auth/me/permissions and /i18n/locales — the clause's 'meta reads' leg has no door in it
• identity-auth.implicit-account-linking-ownership a0-a3: the ref's 'end to end' cases drive the real better-auth handler (AuthManager.handleRequest) but over a hand-rolled in-memory data engine and with sys_account read off that fake, not an admin read through a booted server — they assert each clause's facts at the unit layer only
• identity-auth.import-invitation-and-sso-domain-answers a1: the ref's admin-import-users-invite-link.test.ts asserts the auth.account_invitation template id on the import but never the 'self-requested reset still uses password_reset' half; packages/plugins/plugin-auth/src/admin-import-users-account-invitation.test.ts (cases ① and ②) asserts both and is not in the ref
• identity-auth.import-invitation-and-sso-domain-answers a3: sso-domain-verification-unknown-provider.pin.test.ts mounts the real AuthPlugin on Hono but over createMemoryEngine (a hand-rolled engine fake), so it scores the doors at unit layer only
• identity-auth.invitation-scope-gates a0: ref states its pending half is scored live — consistent
• identity-auth.invitation-scope-gates n1: server-side denial of the forged request is pinned; the UI-hidden half is a5/a4 browser work

From #25817 — release-18.2.0-manual-set, 29 items, at 6679644a, pin b41ed7f68956

• identity-auth.two-factor-backup-codes: A4's at-rest check needs an out-of-band DB read, because REST never returns the column. The item should say so.

From #25823 — addendum, identity-auth.admin-lifecycle-operations at 17f8217b, after #25626

• Coverage gap (new clauses): no item asserts feat(plugin-auth): multi-org Create User joins the administrator's current organization #25626's walled Create User join. Missing clauses: joins the caller's active organization as member, and a body organizationId chooses nothing; 400 NO_ACTIVE_ORGANIZATION with no row; invite-only still joins. Candidate pin: packages/qa/dogfood/test/create-user-organization-join.dogfood.test.ts.
• identity-auth.workspace-org-switch rev 5, personas[2]: stale after feat(plugin-auth): multi-org Create User joins the administrator's current organization #25626 — the recipe now needs the operator to create and set-active an organization before Create User.
• identity-auth.admin-lifecycle-operations automated.ref overclaims: the A0 sign-ins, the A4 live-session half, the A6 stop half and the A9 state read-back beyond two routes are unpinned.

Acceptance

• Every line above is either applied (item revised, revision bumped, history cites the record) or answered on this card with the reason it was not.
• pnpm check:platform-checklist is green.
• The PR links this card and [sweep] v18.2.0 release test sweep #25807.

Generated by Claude Code